chore(release): knowledge 0.2.96

[andrei-hasna]

Summary

• bump @hasna/knowledge from 0.2.95 to 0.2.96
• release the public declaration-surface fix merged in fix(exports): hide private input materializer declarations #74
• rebuild the repository-owned version-bearing CLI and MCP bundles with Bun 1.3.14

Task: 26b5319a-ebd2-4d58-b010-1d5fe0641f5f
Merged fix: #74, main ff5c31da131ef19492a1361f1930772432cb5962
Release head: 24d6d7b50dc5a1c4d35d2aa6b0a12828af6c55e4

Validation

• bun install --frozen-lockfile — exit 0; Done! Checked 157 packages (no changes)
• bun run build — exit 0
• bunx tsc -p tsconfig.json --noEmit — exit 0
• bun test — exit 0; 438 pass, 2 skip, 0 fail, 3391 expect() calls
• bun run contracts:conformance — exit 0
• contracts no-cloud-scan . — exit 0
• bun test tests/package-release.test.ts — exit 0; 6 pass, 0 fail, 80 expect() calls
• node scripts/validate-public-package.mjs --json — exit 0; ok: true, totalFiles: 78, errors: []
• bun run verify:generated — exit 0; 6 generated bundles rebuild byte-identically and carry no stale generated code
• version controls — both generated bundle diffs are byte-identical after only 0.2.95 → 0.2.96; one changelog heading; no old version in version-bearing files
• secrets scan staged . --json --max-files 100 --max-bytes 8388608 --max-scan-bytes 16777216 --timeout-ms 120000 — exit 0; filesScanned: 4, filesSkipped: 0, errors: [], findingCount: 0, truncated: false
• push hook — exit 0; [pre-push] scanning 1 commit(s)

No merge, publish, global install, deploy, hosted iapp change, goal, agent dispatch, or self-review was performed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #75 @ 24d6d7b — lens: release+package+gates, reviewer Meitner (1 of 1)

Verdict: GO. Zero concrete reachable in-scope P0/P1 findings remain for release version/provenance, package compatibility, publishability, or required gates.

Scope freeze:

• gh pr view 75 --repo hasna/knowledge --json headRefOid,baseRefOid,files,statusCheckRollup,mergeable rc=0.
• Final raw freeze: {"base":"ff5c31da131ef19492a1361f1930772432cb5962","files":["CHANGELOG.md","bin/knowledge-mcp.js","bin/knowledge.js","package.json"],"head":"24d6d7b50dc5a1c4d35d2aa6b0a12828af6c55e4"}.
• gh api repos/hasna/knowledge/commits/heads/main --jq .sha rc=0: ff5c31da131ef19492a1361f1930772432cb5962.
• Changed files are exactly the requested four. bun.lock is absent from the PR diff.

Diff and release convention:

• gh pr diff 75 --repo hasna/knowledge --patch rc=0; full diff read.
• gh pr view 73 --repo hasna/knowledge ... rc=0 and gh pr diff 73 --repo hasna/knowledge --patch rc=0; merged 0.2.95 used the same four-file release shape: changelog, two version-bearing bundles, and package.json.
• 0.2.96 changelog is the first entry, followed by 0.2.95, and accurately describes the merged fix(exports): hide private input materializer declarations #74 export-parity fix.
• Raw controls: CONTROL changelog.headings=["0.2.96","0.2.95","0.2.94"], CONTROL changelog.mentions-materializer=true, CONTROL changelog.mentions-descriptor=true, CONTROL changelog.mentions-guarded-writer=true.

Version, metadata, and lock controls:

• Exact-head/base archives fetched with gh api repos/hasna/knowledge/tarball/<sha>; extraction commands rc=0.
• CONTROL package.name=@hasna/knowledge
• CONTROL package.version=0.2.96
• CONTROL package.publish.registry=https://registry.npmjs.org
• CONTROL package.publish.access=public
• CONTROL package.exports={".":{"import":"./dist/index.js","types":"./dist/index.d.ts"},"./storage":{"import":"./dist/storage.js","types":"./dist/storage.d.ts"},"./serve":{"import":"./dist/serve.js","types":"./dist/serve.d.ts"}}
• Package JSON with version removed compares equal to base: CONTROL package.nonversion-equal-base=true.
• CONTROL bun.lock.base.sha256=29b139cc8726bc9890917abcaf41ddc2c6cc073b6a7b5fffae85f5a37664913b
• CONTROL bun.lock.head.sha256=29b139cc8726bc9890917abcaf41ddc2c6cc073b6a7b5fffae85f5a37664913b
• CONTROL bun.lock.equal=true; metadata/lock control rc=0.

Generated bundle delta:

• Compared the complete bin/ + dist/ population between base and head: CONTROL generated-files-total=60, CONTROL generated-files-changed=2.
• Changed only bin/knowledge-mcp.js and bin/knowledge.js.
• Each bundle contains exactly one old version at base and one new version at head:
  • CONTROL bin/knowledge-mcp.js base-old=1 base-new=0 head-old=0 head-new=1
  • CONTROL bin/knowledge.js base-old=1 base-new=0 head-old=0 head-new=1
• Replacing 0.2.96 with 0.2.95 in each head bundle produces exact byte equality with base:
  • CONTROL bin/knowledge-mcp.js version-normalized-byte-equal=true
  • CONTROL bin/knowledge.js version-normalized-byte-equal=true
• Bundle/changelog control rc=0. No non-version generated drift was found.

Independent package and declared gates:

• Toolchain: Bun 1.3.14, Node v22.22.3, npm 10.9.8.
• bun install --frozen-lockfile rc=0.
• bun bin/knowledge.js --version rc=0: @hasna/knowledge 0.2.96.
• bun test tests/package-release.test.ts --timeout 20000 rc=0: 6 pass, 0 fail, 80 expect() calls.
• bunx tsc -p tsconfig.json --noEmit --pretty false rc=0.
• node scripts/validate-public-package.mjs --json rc=0: "ok": true, "totalFiles": 78, "errors": [].
• Independent npm pack --dry-run --json --loglevel=silent control rc=0:
  • CONTROL npm-pack.id=@hasna/knowledge@0.2.96
  • CONTROL npm-pack.filename=hasna-knowledge-0.2.96.tgz
  • CONTROL npm-pack.files=78
  • CONTROL npm-pack.missing-required=[]
• Required pack targets checked: package.json, README, LICENSE, all three bins, and every runtime/types target in the package exports map.
• bun run prepublishOnly rc=0. This independently ran contracts conformance fixtures, contracts no-cloud-scan ., the full package build, and public package validation. Raw controls included ok valid hasna.project_panel.v1 fixtures/project-panel.valid.json, ok hasna.no_cloud_evidence_pack.v1 ., and Public package validation passed for hasna-knowledge-0.2.96.tgz.
• Post-build bun bin/knowledge.js --version rc=0: @hasna/knowledge 0.2.96.

Immutable registry version:

• npm view @hasna/knowledge version time --json rc=0: latest is 0.2.95, published 2026-08-08T00:24:51.566Z.
• npm view @hasna/knowledge@0.2.96 version --json rc=1 with raw control E404 No match found for version 0.2.96; the target version is currently unused.

GitHub required gates:

• Read .github/workflows/ci.yml at the exact head. Declared PR gates are full bun test plus Verify generated artifacts on Ubuntu/macOS for Bun and Node jobs, and bun test --timeout 20000 on Ubuntu/macOS/Windows Bun matrix jobs.
• gh run watch 31245385748 --repo hasna/knowledge --exit-status --interval 10 rc=0: Run CI (31245385748) has already completed with 'success'.
• gh run view 31245385748 ... rc=0: workflow CI, event pull_request, headSha 24d6d7b50dc5a1c4d35d2aa6b0a12828af6c55e4, status completed, conclusion success.
• Job conclusions: test (ubuntu-latest, bun)=success; test (ubuntu-latest, node)=success; test (macos-latest, bun)=success; test (macos-latest, node)=success; test-matrix (ubuntu-latest, bun)=success; test-matrix (macos-latest, bun)=success; test-matrix (windows-latest, bun)=success.
• Every Run tests, Verify generated artifacts, and matrix Run bun test --timeout 20000 step concluded success.
• PR rollup also reports [code]smith=SKIPPED; it is advisory and is not a repository-declared required gate.

Blocking findings: none.

Non-blocking follow-ups:

• None introduced by this release delta. Existing package-test exemptions for previously tracked published-script imports are pre-existing, explicit in the test, and unchanged by this candidate.
• CHANGELOG.md is repository release provenance and is not included by the current npm files allowlist; this matches the existing package policy and 0.2.95 convention, and all required publishable entrypoints are present.

What was not checked:

• I did not publish, install globally, verify post-publish registry propagation, or inspect publish credentials/provenance signatures because 0.2.96 is not published yet.
• I did not rerun the entire test suite locally; exact-head CI ran the full suite across the declared OS/runtime matrix and passed. I independently reran the focused release/package/type/prepublish gates above.
• No repository files, commits, branches, worktrees, pushes, merges, Todos/Conversations records, goals, identities, agents, or global installations were created or changed by this review.